Zero Radar
← feed
CriticalVulnerabilityCVE-2026-61737updated 30 Oct 2026, 15:18 UTC

ng-antd-admin login tokens can be forged with a built-in default secret

The admin template ships with a built-in default key used to sign login tokens. If the site still uses that default, an attacker can make their own login tokens and act as any user, including administrators.

Fix available · out Official source
SeverityCriticalCVSS 9.8 of 10
Being exploited?UnclearNo reports either way yet
Fix available?YesVersion 22.0 or later; it rejects the shipped secret in production (but only warns in non-production environments) · since 30 Oct 2026
How sure is this?Official sourceBacked by an official source

How the attack works simplified

  1. 1Attacker finds appUses the public default secret from the template
  2. 2Forges a tokenSigns a JWT with the known default secret
  3. 3Sends token to APIPresents forged token as a logged-in user
  4. 4Server accepts itDefault secret not replaced, so token is trusted
  5. 5Admin access gainedAttacker reads data and performs actions
  6. ResultAttacker takes over accounts and data

What happened

ng-antd-admin (Angular and NestJS admin template) before version 22.0 uses a hardcoded default JWT signing secret; if a deployment does not replace it, attackers can forge valid JWTs.

Why it is dangerous: Attackers can bypass authentication and authorization, impersonate any user including admins, read protected data, and perform unauthorized operations, leading to full account takeover.

Are you affected?

You are affected if you run ng-antd-admin before version 22.0 and have not replaced the default JWT secret.

ng-antd-admin versions prior to 22.0 with the default JWT secret in use

What to do

  1. Update ng-antd-admin to version 22.0 or later
  2. Set a strong, unique JWT secret in your environment configuration, not the shipped default
  3. Rotate any tokens issued under the default secret and review admin accounts for unauthorized activity

Timeline

  1. 30 Oct 2026, 15:16 UTC
    Publicly disclosed
  2. 30 Oct 2026, 15:16 UTC
    Reported by NVD · NVD
  3. 30 Oct 2026, 15:18 UTC
    Picked up by Zero Radar

Sources 1 report, oldest first

Official vendor, government CERT or advisory database

Technical details

ID
CVE-2026-61737
CVSS
9.8 / 10
Disclosed
30 Oct 2026, 15:16 UTC
On Zero Radar
30 Oct 2026, 15:18 UTC (2 min after disclosure)
Last change
30 Oct 2026, 15:18 UTC

The plain-language parts and the attack diagram were written by an AI model (anthropic/claude-haiku-5.5) from the sources above. Facts like versions, exploitation and dates come from the sources themselves. How Zero Radar works

ng-antd-admin login tokens can be forged with a built-in default secret · Zero Radar